Thunderbird 91.5.0 fixes several security issues | #emailsecurity | #phishing | #ransomware | #cybersecurity | #infosecurity | #hacker


Thunderbird 91.5.0 Stable is a security update that addresses several issues in the open source email client.

The new version of Thunderbird Stable is already available. It is pushed to user systems, provided that automatic updating has not been disabled.

Thunderbird users may run manual checks for updates to install the update early. Select Help > About Thunderbird to display the installed version and have Thunderbird run a check for updates manually. Users who don’t see the menubar need to press the Alt-key on the keyboard to display it.

The official release notes list just three entries: two refer to fixed issues in the email client, one links to the security advisories page, which details the fixed security issues in the client.

The two non-security issues that were fixed address a display issue for RSS keyword labels and missing information on Thunderbird’s about dialog page.

The security advisories page for Thunderbird 91.5 lists 14 security issues, many of which come from the code that Thunderbird shares with the Firefox web browser.

The highest severity rating of all vulnerabilities is high, second only to the critical rating. Here is the full list of security issues patched in the new Thunderbird version:

  1. CVE-2022-22746: Calling into reportValidity could have lead to fullscreen window spoof
  2. CVE-2022-22743: Browser window spoof using fullscreen mode
  3. CVE-2022-22742: Out-of-bounds memory access when inserting text in edit mode
  4. CVE-2022-22741: Browser window spoof using fullscreen mode
  5. CVE-2022-22740: Use-after-free of ChannelEventQueue::mOwner
  6. CVE-2022-22738: Heap-buffer-overflow in blendGaussianBlur
  7. CVE-2022-22737: Race condition when playing audio files
  8. CVE-2021-4140: Iframe sandbox bypass with XSLT
  9. CVE-2022-22748: Spoofed origin on external protocol launch dialog
  10. CVE-2022-22745: Leaking cross-origin URLs through securitypolicyviolation event
  11. CVE-2022-22744: The ‘Copy as curl’ feature in DevTools did not fully escape website-controlled data, potentially leading to command injection
  12. CVE-2022-22747: Crash when handling empty pkcs7 sequence
  13. CVE-2022-22739: Missing throttling on external protocol launch dialog
  14. CVE-2022-22751: Memory safety bugs fixed in Thunderbird 91.5

Now You: do you use Thunderbird? What would you like to see supported?

 

Summary

Article Name

Thunderbird 91.5.0 fixes several security issues

Description

Thunderbird 91.5.0 Stable is a security update that addresses several issues in the open source email client.

Author

Martin Brinkmann

Publisher

Ghacks Technology News

Logo

Advertisement

Original Source link



Original Source link

Leave a Reply

Shqip Shqip አማርኛ አማርኛ العربية العربية English English Français Français Deutsch Deutsch Português Português Русский Русский Español Español

National Cyber Security Consulting App

 https://apps.apple.com/us/app/id1521390354

https://play.google.com/store/apps/details?id=nationalcybersecuritycom.wpapp


Ads

NATIONAL CYBER SECURITY RADIO

Ads

ALEXA “OPEN NATIONAL CYBER SECURITY RADIO”

National Cyber Security Radio (Podcast) is now available for Alexa.  If you don't have an Alexa device, you can download the Alexa App for free for Google and Apple devices.   

nationalcybersecurity.com

FREE
VIEW